What privacy should mean for footage tools

Privacy, in a footage tool, is not a padlock icon. It is the ability to answer one question at any moment: where has every byte of my footage been, and did I know before it went there. A tool that lets you answer that is private in the only sense that matters professionally. A tool that does not is asking for trust it has not earned, whatever its landing page says.

Full disclosure before the sermon: I build ClipLogger, and ClipLogger sells cloud compute. This is not an argument against the cloud. It is an argument about who does the choosing.

The failure mode is silence, not hacking

The scenario that should worry a working shooter is not a breach. It is this: you run an auto-tag pass on a client's unreleased footage, and months later you learn, from a terms-of-service page, that frames were leaving your machine for a third-party API the whole time. Nothing was stolen. Nobody was hacked. You were not told, because a checkbox you clicked in 2024 counted as being told.

Client NDAs do not carry a clause for "the vendor's vendor." If frames of an unannounced product crossed the internet, it does not matter much that they crossed it encrypted. The problem was the routing, not the lock on the door.

Four questions to ask any tool

This section is tool-agnostic. Ask these of anything that touches your footage, including mine.

One: when I run analysis, where do the frames go, exactly, and can I point at the setting that decides it. Two: am I told per run, with the destination and the cost, or did I consent once inside a document nobody reads. Three: afterward, can I tell which values came from where, per clip, or is cloud output blended invisibly with local output. Four: when the local path fails, does the tool fall back to the cloud silently, or does it degrade and say so.

A vendor with good answers gives them crisply, in one breath. A vendor who answers "everything is encrypted" has answered a question you did not ask.

Every value should name the engine that made it

A description you typed, a caption from a model on your Mac, and a caption from a cloud run are three different facts with three different routing histories, and the metadata should say which is which. ClipLogger stamps provenance on every reasoning result at the moment it runs (local, your own server, your own API key, or the Rush cloud) and shows it on the clip as a badge with a plain-language tooltip. Values from before provenance tracking existed say "provenance unrecorded" rather than guessing, because a privacy claim reconstructed after the fact is a story, not a record.

That is what visible provenance means: not a paragraph on a policy page, a badge on the clip you can check while the client is standing behind you.

Local must be local by construction

A "local" engine that quietly falls back to a cloud API when the local server is unreachable is a cloud engine wearing a costume. The honest construction fails toward privacy. On the local engine, frames stay on your machines. If your local endpoint is down, the default behavior is to degrade to on-device evidence, never to route out to a cloud key. The routing decision is re-checked against your current settings immediately before every send, not cached from happier times. There is a checkbox to allow cloud fallback for people who want it, and it ships off, because a fallback you did not choose is the terms-of-service problem all over again with better intentions.

Cloud is a fine choice when it is your choice

I sell the cloud lane, so here is the honest version of it. Rush runs a batch across parallel workers on larger models than a laptop can hold: faster, and better at hard frames, small on-screen text, busy scenes. It uploads sampled frames from the clips you submitted, never your source files, and every result comes back marked with Rush provenance into the same review flow as a local run.

The privacy is not that the cloud is absent. It is that the cloud is chosen, per run, with the clip count and the cost on screen before anything is submitted, while local stays free and private by construction the rest of the week. You pay to go faster, never to get your own work back. Choosing cloud on Tuesday because a deadline beats your hardware, and staying local on Wednesday because an NDA says so, is what control looks like in practice.

Judge a footage tool by whether you can say where every frame went last month, and whether you knew before each one left.